Hi lightsaber,
I will leave other points to other teammembers 
But one important thing I would like to clarify 
We take full responsibility for the security of Mudita Kompakt and Mudita OS K.
Android 12 was the base platform, kind of the starting point, on which we built our version of the operating system. The Android version number alone does not really describe the security status of the device.
We continuously review Android security bulletins, vulnerabilities and available security patches. We check which issues are relevant to our hardware and software configuration, then integrate, test and release the required fixes for MuditaOS K.
This means that security maintenance does not depend only on upgrading the whole operating system to Android 13 or a newer version. Security fixes can also be backported and implemented independently of a major Android version upgrade - and that is what we are doing.
Of course, sideloaded applications are also the responsibility of their developers, and users should install apps only from trusted sources, this is kind of out of our control. However, we remain responsible for maintaining the security of the operating system and the device itself.
I hope this helps to have a bit more comfort, useing the device